Spanish authorities have arrested a 35-year-old Dutchman they say is "suspected of unprecedented heavy attacks" on Spamhaus, the international group that helps network owners around the world block spam.

A press release (English translation here) issued by the Dutch Public Prosecutor Service identified the suspect only by the initials SK and said he was living in Barcelona. A variety of circumstantial evidence, mostly taken from this Facebook profile, strongly suggests the suspect is one Sven Olaf Kamphuis. He's the man quoted in a March 26 New York Times article saying a Dutch hosting company called CyberBunker, which Kamphuis is affiliated with, was behind distributed denial-of-service attacks aimed at Spamhaus. Kamphuis later denied he or CyberBunker had anything to do with the attacks.

With peaks of 300 gigabits per second, the March attacks were among the biggest ever recorded. Besides their size, they were also notable because they attacked the London Internet Exchange, a regional hub where multiple networks from different service providers connect. As Ars writer Peter Bright explained, the size and technique threatened to clog up the Internet's core infrastructure and make access to the rest of the Internet slow or impossible. While some critics said that assessment was overblown, Bright provided this follow-up explaining why the attacks had the potential to break key parts of the Internet.

The crippling distributed denial-of-service (DDoS) attacks began a few weeks after Spamhaus added CyberBunker to one of the real-time blacklists that ISPs use to block e-mail from networks suspected of engaging in, or at least turning a blind eye to, the sending of spam. CyberBunker has long been known as an "anything goes" host provider. As long as content isn't "child porn and anything related to terrorism," the company permits it. According to an article published Friday by KrebsOnSecurity, Spamhaus officials contacted CyberBunker after seeing botnet controllers and illegal pharmaceutical operators hosted on its service. "We got a rude reply back, and he made claims about being his own independent country in the republic of CyberBunker, and said he was not bound by any laws and whatnot," an unnamed Spamhaus official told reporter Brian Krebs. Kamphuis' Facebook page has also claimed he has diplomatic immunity.

It should be emphasized that so far there is no official confirmation that the SK in custody is Kamphuis. Even if it is, he should still be presumed innocent until proven otherwise. Dutch prosecutors said SK's Barcelona residence was searched and computers, data carriers, and mobile phones were seized. They also said they expect SK to be transferred to Dutch authorities soon. We'll be eager to learn if there's evidence that can conclusively tie the man to one of the biggest reported DDoS attacks ever.

It's a sad day when journalists have to remind us of the most basic principle of our justice system. Kudos to Ars for specifically pointing out that it does not endorse the kind of witch hunt triggered by articles of the big 3.

It's a sad day when journalists have to remind us of the most basic principle of our justice system. Kudos to Ars for specifically pointing out that it does not endorse the kind of witch hunt triggered by articles of the big 3.

This is exactly why Dutch police, prosecution service and media only release initials of arrested suspects.

Here in Britain the media prefer not only to use full names but placenames and streetnames too. Just to make sure the angry mob has burned your house down before a court of law has deemed you innocent.

It's a sad day when journalists have to remind us of the most basic principle of our justice system. Kudos to Ars for specifically pointing out that it does not endorse the kind of witch hunt triggered by articles of the big 3.

Except "presumed innocent until proven otherwise" is a LEGAL restriction on the conduct of the prosecution. It does not bind anyone else. Kamphius is a world-class scumbag by his own words and actions- whether you think we should all presume his innocence amidst all of his "I didn't do it, really, wink wink" posturing means nothing at all.

His attacks on Spamhaus alone make him worthy of my contempt, not to speak of his explicit support of "the right to send spam". So I fervently hope that SK is Kamphius, and I also hope he gets the book thrown at him.

This is exactly why Dutch police, prosecution service and media only release initials of arrested suspects.

Here in Britain the media prefer not only to use full names but placenames and streetnames too. Just to make sure the angry mob has burned your house down before a court of law has deemed you innocent.

It's a sad day when journalists have to remind us of the most basic principle of our justice system. Kudos to Ars for specifically pointing out that it does not endorse the kind of witch hunt triggered by articles of the big 3.

Ours as in the Dutch? Ours as in the United States of America? Or Ours as in the global communities?

Cause, not all countries do have an assumption of innocence until proven guilty in their constitutions or judicial codes.

Though, last I checked, the United States and all EU members do have that. Acting that way though...

It's a sad day when journalists have to remind us of the most basic principle of our justice system. Kudos to Ars for specifically pointing out that it does not endorse the kind of witch hunt triggered by articles of the big 3.

This is exactly why Dutch police, prosecution service and media only release initials of arrested suspects.

Here in Britain the media prefer not only to use full names but placenames and streetnames too. Just to make sure the angry mob has burned your house down before a court of law has deemed you innocent.

I've seen that in local newspapers but not in national media. Is that really spread to national media?

Oh, and thanks DOOManiac for the Daily Show link - unfortunately it is not available in Australia. I had to click through several sites before I found one that would let me watch a brilliant video. Somehow I don't think it's Jon Stewart who's enforcing that blockade, but it provides yet another explanation for why so many Australians are apparently raising the skull & crossbones and setting sail for ye olde bootlegged Game of Thrones.

The US is too busy for such things. The government seeks ways to "turn off" the internet at will, as well as ways to tell others around the planet what is and isn't appropriate content. Sure, piracy is a problem, but the government involvement regardless of sovereignty is a bit much. When the Republicans propose the "Envoy Act" again, and the US has a copyright agent in every embassy taking directions from media lobbyists, maybe someone else will finally think it's gotten a bit ridiculous.

This event could be a wake-up call to spammers and DDoS perps-- it is possible that the internet does not provide an impenetrable cloak of anonymity. Perps can be caught, after all.

Everyone can eventually be caught, it just takes having the methods available and putting all the pieces together. As time progresses, more things are exposed sometimes via the hubris of the culprits and sometimes via newer methods. People don't seem to realize that anonymity only exists when no one can find out anything at all about you. Bragging in tweets, IRC, on blogs, the internet, even coming out in public to deny or confirm things like this person did, reveals tiny clues, bits and pieces, that are eventually put together to form some sort of profile of the person and that happens because you never know what the others trying to profile you already know so those tiny clues could fill a spot in their puzzle that locks everything together.

I had a guy that ripped me off for something, back in the day when tricks with paypal could be used to take back payments for purchases and send fake payments. It took me almost five years, but using his little bits of information scattered around here and there in his posts on various forums I was able to gather enough information to eventually give me a name and address. I made it my mission to find this guy, looked at his posts on dozens of forums every day. Then I had his sorry butt arrested and it turned out he had done the same thing to others, so he ended up serving three years for fraud due to the information I had discovered plus he got sued and we got our money back. From various things I was able to find out the person was male, his various aliases used on the internet, and lots of various pieces of information but for a long time I had nothing to tie them all together. What really put the final piece in the puzzle was a picture he posted taken by him, in the picture according to his posts there was a friend of his with a local celebrity in Alaska taken, as he posted, "in front of my work" and I already knew (or least it was indicated) from various other posts other information that indicated the type of work he did and that he worked with "two others". There were no identifying landmarks or any names or anything identifying as to location in the picture but there was a time and date stamp in the picture and the posts revealed the name of the 'local celebrity'. Contacting the 'local celebrity' finally yielded the work location where the picture was taken at which only three people worked, one female and the other two male. One male at the work place was identified from the picture as the friend in the picture so it left the other guy at the work location as the rip off guy. That gave me a reasonable belief to take to the prosecutor, and it went from there.

Never assume simply because its the internet that anonymity exists. The most simple, smallest, seemingly unrelated things can be put together correctly eventually and you can be found.

As Sven learned the hard way, a reporter is never your friend. Nothing is "off the record." Don't try to buddy up to them by telling secrets, even if you assume they already know. Unless you are some kind of dictator or corporate fat cat with the power to destroy them, they won't think twice about destroying you if they can get a good story out of it.

It's a sad day when journalists have to remind us of the most basic principle of our justice system. Kudos to Ars for specifically pointing out that it does not endorse the kind of witch hunt triggered by articles of the big 3.

Except "presumed innocent until proven otherwise" is a LEGAL restriction on the conduct of the prosecution. It does not bind anyone else. Kamphius is a world-class scumbag by his own words and actions- whether you think we should all presume his innocence amidst all of his "I didn't do it, really, wink wink" posturing means nothing at all.

His attacks on Spamhaus alone make him worthy of my contempt, not to speak of his explicit support of "the right to send spam". So I fervently hope that SK is Kamphius, and I also hope he gets the book thrown at him.

You've got that exactly backward. Presumption of innocence applies to everyone EXCEPT the prosecution. The prosecutor's job is to overcome the presumption of innocence.